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DETAILED ACTION 

1. This Office Action is in response to the Amendment entered on October 27, 
2005 for the application number 09/826,602. 

2. The pending claims 1 through 37 are examined herein as follows. 

Claim Rejections - 35 USC § 103 
The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action • 

(a) A patent may not be obtained though the invention is not identically disclosed or described as 
set forth in section 102 of this title, if the differences between the subject matter sought to be 
patented and the prior art are such that the subject matter as a whole would have been obvious at 
the time the invention was made to a person having ordinary skill in the art to which said subject 
matter pertains. Patentability shall not be negatived by the manner in which the invention was 
made. 

3. Claims 1-10, 13-24, and 28-37 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Muret et al (U.S. Pat. No. 6,792,458) and Adrian Cockcroft, 
"Observability", Sun Microsystems, Inc., 1999. 

Muret discloses a system and method for monitoring and analyzing Internet 
traffic as per the claimed subject matter of claim 1, Muret discloses a user interface 
browser for displaying processed and analyzed network data to an end user. For 
example, as illustrated in Figs. 22-24, the user interface displays web site traffic in 
terms of visitors monitored. Although Muret discloses a user interface browser 
(Fig. 21, #1810) for interacting and managing traffic information, but Muret's 
browser interface ("dashboard") does not show a network status console area; a 
network events viewing area; and a trend viewing area as required in the claim. 
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Cockcroft, however, discloses integrated interface console, SyMON, Sun 
Management Center for monitoring a small number of systems with customized 
data views. Cockcroft also discloses a network status console area (Figs. 5 and 8); a 
network events viewing area (Figs. 6 and 7); and a trend viewing area (e.g., Figs. 
10-14) as required in the claim. Cockcroft and Muret are analogous art because they 
are from the same field of endeavor, monitoring and managing network devices and 
network traffic data. At the time of the invention, it would have been obvious to a 
person of ordinary skill in the art to combine Cockcroft's integrated interface 
console with the browser interface of Muret The suggestion /motivation for doing so 
would have been to provide a more integrated traffic management console to the 
user. Therefore, it would have been obvious to combine Cockcroft with Muret to 
obtain the invention as specified in claim 1. 

With regard to claim 2: 

Muret and Cockcroft teach the network status console area further 

comprises: an alerts area comprising a FIFO queue of critical alerts (Cockcroft, 

pages 4, 7, Figs. 7 and 12). 

Muret and Cockcroft teach a health monitor area showing a percentage of 

network traffic that does not violate current traffic and over a predetermined 

amount of time (Cockcroft, Figs. 2 and 3, page 10). 

With regard to claim 3: 
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Muret and Cockcroft teach a tear off status console window for said end user 
to keep console window open on a desktop to monitor network status (Cockcroft, 
Fig. 2, load moduJeyane) 
With regard to claim 4: 

Muret and Cockcroft disclose a browser (web-based) traffic management 
interface (Muret, Figs 21 and 24). 
With regard to claim 5: 

Muret and Cockcroft teach that said user alerts are updated on a real-time 
basis (Cockcroft, page 19) 
With regard to claim 6: 

Muret and Cockcroft teach that any of said user alerts links to corresponding 
alert details information (Cockcroft, pages 3, 4 and 7). 
With regard to claim 7: 

Muret and Cockcroft teach that the underlying traffic data of said health 
monitor is updated automatically at a regular interval (Cockcroft, pages 1, and 7- 
8). 

With regard to claim 8 : 

Muret and Cockcroft teach severity alerts levels are distinguished by color 
codes (Cockcroft, Fig. 6, page 3) 
With regard to claim 9: 
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Muret and Cockcroft teach that said network events viewing area further 
comprises links to at least to a visitors information events (Muret, Figs. 22 and 
24, column 22, lines 45-52) 
With regard to claim 10: 

Muret and Cockcroft teach that said configurable time period comprises any 
of a user selected date and time range, for example, today, last 24 hours, yesterday, 
and last seven days, etc (column 27, lines 1-11, Figs. 22, 23, and 27). 
With regard to claim 13: 

Muret and Cockcroft teach that user defined and configurable query and 
report settings are stored (Muret, column 20, lines 23*53). 
With regard to claim 14: 

Muret and Cockcroft teach that said trend-viewing area further comprises 
finks to network events summary information (Cockcroft, page 12). 
With regard to claim 15 : 

Muret and Cockcroft teach that said trend viewing area further comprises a 
snapshot report (QuickWeek) section, containing at least a predetermined number 
of most frequent target IP-addresses (or pages) versus count during said past 
predetermined number of days (Fig. 30). 
With regard to claim 16: 

Muret and Cockcroft further teach that the trend viewing area is user 
customizable (Cockcroft, page 2). 
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With regard to claim 17- 

Muret and Cockcroft further teach embeddable trend charts into details 
information, said trend over a time range dynamically configurable by said end 
user (Cockcroft, page 2). 
With regard to claim 18^ 

Muret and Cockcroft further teach the trend charts comprise at least network 
event details (Cockcroft, e.g., network throughout over a day, Fig. 14). 
With regard to claim 19: 

Muret and Cockcroft further teach the network event details information 
further comprises at least a source IP -address (Fig. 23). 
With regard to claim 21" 

Muret and Cockcroft further teach that the application data comprises at 
least HTTP-URL (column 4, lines 40-55). 
With regard to claim 21" 

Muret and Cockcroft further teach protocol event details information in 
context of a particular network event to a database from which said information is 
retrieved on an as-needed basis (Muret, column 12, lines 19-62). 
With regard to claim 22 ' 

Muret and Cockcroft teach that said protocol event details information 
further comprises data from attributes (Cockcroft, page 8). 
With regard to claim 23* 
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Muret and Cockcroft teach that the data attributes includes at least rule 
name for said protocol event (Cockcroft, page 8). 
With regard to claim 24: 

Muret and Cockcroft teach that alert event details information, said 
information includes at least details of network event that caused alert (Cockcroft, 
e.g., detail messages are shown Figs. 6 and 7). 
With regard to claim 28 " 

Muret and Cockcroft further disclose means for ad-hoc querying by said end 
user (Muret, Fig. 12, column 22, lines 5-16). 
With regard to claim 29 • 

Muret and Cockcroft further disclose that means for ad-hoc querying further 
comprises filtering results by at least policy target IP-address (Muret, column 22, 
lines 5-27, Fig. 23). 
With regard to claim 30 - 

Muret and Cockcroft further disclose means for ad-hoc querying further 
comprises an advanced search feature (Fig. 12, column 28, lines 11-25). 
With regard to claim 31- 

Muret and Cockcroft further disclose that the advanced search feature is 
implemented using a dialog box (column 28, lines 11-14). 
With regard to claim 32: 



Application/Control Number: 09/826,602 Page 8 

Art Unit: 2173 

Muret and Cockcroft further disclose that the informational aids provide 
English written in-depth information representation of rule or policy (column 27, 
12-15). 

Wirth regard to claim 33: 

Muret and Cockcroft further disclose that the informational aids are linked to 
by said end user when said end user places a cursor over an appropriate field 
thereby displaying a tool tip of corresponding descriptions of said fields (Cockcroft, 
Fig. 4). 

With regard to claim 34: 

Muret and Cockcroft further disclose that the description includes at least 
rule descriptions (Cockcroft, page 3). 
With regard to claim 35 ' 

Muret and Cockcroft further disclose informational aids further comprise any 
of- context sensitive help (Muret, column 27, fines 12-15). 
With regard to claim 36 : 

Muret and Cockcroft further disclose a printer icon on the toolbar of the 
browser to generate a printed page (Muret, Figs. 28). 
With regard to claim 37 : 

Muret and Cockcroft also discloses that the operating system time set 
feature, user can set the time zone so that it can be displayed to a user similar to 
that shown in Muret, Fig. 22. 
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4. Claims 11, 12, 26 and 27 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Muret et al (U.S. Pat. No. 6,792,458), Adrian Cockcroft, 
"Observability", Sun Microsystems, Inc., 1999 andTrcka et al (U.S. Pat. No. 
6,453,345). 

With regard to claims 11, and 12: 

While Muret and Cockcroft teach visitors event summary information 
(Muret, Fig. 22-24), but fail to teach violator visitor events summary information 
containing a count of the number of violations for each violating IP-address. Trcka, 
however, teaches a user interface for viewing and identifying the rejected users 
(violators) when trying to access a destination network address (IP address) (Fig. 
19). Trcka also disclose detailed summary information (e.g., name, time, date, user 
id, etc) of a rejected user when attempting to access the network address (Fig. 19). 
At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to combine Trcka's rejected user identifying means with Muret and 
Cockcroft visitor's foot step tracking window (Muret, Fig. 24). The suggestion 
/motivation for doing so would have been to enable identify violators when trying to 
access the system. 
With regard to claim 26: 

Muret, Cockcroft and Trcka further disclose means for each of said alerts to 
generate an alert email, (Trcka, column 13, lines 8-15) said alert email includes at 
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least any of, but not limited to time said alert occurred (Trcka, Fig. 17, column 13, 
lines 8-15). 

With regard to claim 27: 

Muret, Cockcroft and Trcka further disclose that a customer information area 

allowing said end user to configure a list of email addresses to receive said alert 

email (Muret, column 19, lines 17-23, column 20, lines 40-47). 

5. Claim 25 is rejected under 35 U.S.C. 103(a) as being unpatentable over Muret 

et al (U.S. Pat. No. 6,792,458), Adrian Cockcroft, "Observability", Sun 

Microsystems, Inc., 1999 andMohaban et al (U.S. Pat. No. 6,463,470). 

With regard to claim 25: 

Muret and Cockcroft teach enabling rule (policy) and setup rule (policy) 
thresholds (Cockcroft, page 3), but Mohaban discloses a policy update information 
area showing each time a new policy is installed, said information comprising, date 
of policy information, description of policy, and link to English representation of 
said newly installed policy (Fig. 6-8E, column 18, lines 64-column 19, lines 38, 
column 22, lines 32-60, column 26, lines 44xolumn 27, lines 11). At the time of the 
invention, it would have been obvious to a person of ordinary skill in the art to 
incorporate/integrate Mohaban's policy with Muret and Cockcroft because it is 
advantageous to integrates applications into a policy-based networking system 
(column 4, lines 60-64). . Therefore, it would have been obvious to combine Cockcroft 
Muret and Mohaban to obtain the invention as specified in claim 25. 
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CONCLUSION 



6. Examiner has pointed out particular references contained in the prior arts of 
record in the body of this action for the convenience of the applicant. Although the 
spec6ed citations are representative of the teachings in the art and are applied to 
the specific limitations within the individual claim, other passages and Figures may 
apply as well. It is respectfully requested from the applicant, in preparing the 
response, to consider fully the entire references as potentially teaching all or part of 
the claimed invention, as well as the context of the passage as taught by the prior 
arts or disclosed by the examiner. 

7. Any inquiry concerning this communication or earlier communications from 
the Examiner should be directed to Tadesse Hailu, whose telephone number is (571) 
272-4051. The Examiner can normally be reached on M-F from 10:30 - 7:00 ET. If 
attempts to reach the Examiner by telephone are unsuccessful, the Examiner's 
supervisor, John Cabeca, can be reached at (571) 272-4048 Art Unit 2173. 

9. An inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the Group receptionist whose telephone number is 
(703) 305-3900. 

Examiner Tadesse Hailu /V . 



Art Unit 2173 - Operator Interface 
1/5/06 




